# Website Security Headers Scanner (Grade, HSTS, CSP, Cookies) (`scrapers_lat/website-security-headers-scanner`) Actor

Scan any website and grade its HTTP security headers, cookie flags, HTTPS enforcement and TLS certificate. Letter grade A+ to F, per-header pass/fail, HSTS/CSP parsing, redirect chain, optional cert expiry and AI remediation. For audits, PCI/SOC2 prep, recon and vendor due-diligence.

- **URL**: https://apify.com/scrapers\_lat/website-security-headers-scanner.md
- **Developed by:** [Scrapers Lat](https://apify.com/scrapers_lat) (community)
- **Categories:** Developer tools, SEO tools, Other
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $8.32 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![Website Security Headers Scanner (Grade, HSTS, CSP, Cookies)](https://scrapers.lat/banners/website-security-headers-scanner.png)](https://apify.com/scrapers_lat/website-security-headers-scanner)

## Website Security Headers Scanner (Grade, HSTS, CSP, Cookies)

Scan any website and get a clear, transparent security grade for its HTTP response headers, cookie flags, HTTPS enforcement and TLS certificate. Point it at a list of URLs or bare domains and it returns one graded record per site: a letter grade (A+ to F), a 0 to 100 score, per-header pass/fail, parsed HSTS and CSP, cookie security flags, the redirect chain, and optional certificate details plus an AI remediation plan.

Here is one real result (Content-Security-Policy value trimmed for readability), with every field the actor returns:

```json
{
  "url": "https://github.com/",
  "finalUrl": "https://github.com/",
  "statusCode": 200,
  "redirectChain": [],
  "httpsEnforced": true,
  "grade": "C",
  "score": 73,
  "securityHeaders": {
    "strictTransportSecurity": {
      "raw": "max-age=31536000; includeSubdomains; preload",
      "maxAge": 31536000,
      "includeSubDomains": true,
      "preload": true
    },
    "contentSecurityPolicy": {
      "present": true,
      "weaknesses": ["unsafe-inline"],
      "weak": true,
      "raw": "default-src 'none'; base-uri 'self'; ... frame-ancestors 'none'; ..."
    },
    "xFrameOptions": "deny",
    "xContentTypeOptions": "nosniff",
    "referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin",
    "permissionsPolicy": null,
    "crossOriginOpenerPolicy": null,
    "crossOriginEmbedderPolicy": null,
    "crossOriginResourcePolicy": null
  },
  "infoLeakHeaders": { "server": "github.com" },
  "server": "github.com",
  "cookies": [
    { "name": "_gh_sess", "secure": true, "httpOnly": true, "sameSite": "Lax" },
    { "name": "_octo", "secure": true, "httpOnly": false, "sameSite": "Lax" },
    { "name": "logged_in", "secure": true, "httpOnly": true, "sameSite": "Lax" }
  ],
  "cookieFlagsOk": false,
  "insecureCookies": [
    { "name": "_octo", "problems": ["missing HttpOnly"], "secure": true, "httpOnly": false, "sameSite": "Lax" }
  ],
  "missingHeaders": ["permissions-policy", "cross-origin-opener-policy", "cross-origin-resource-policy"],
  "weakHeaders": ["content-security-policy (unsafe-inline)"],
  "tlsCertificate": {
    "subject": "github.com",
    "issuer": "Sectigo Public Server Authentication CA DV E36",
    "issuerOrg": "Sectigo Limited",
    "validFrom": "2026-07-03T00:00:00.000Z",
    "validTo": "2026-09-30T23:59:59.000Z",
    "daysUntilExpiry": 45,
    "isExpired": false,
    "san": ["github.com", "www.github.com"],
    "sanCount": 2,
    "keyType": "EC",
    "keyBits": 256,
    "serialNumber": "72010E03F4A067FE4E796266430718F6",
    "hostnameMatches": true
  },
  "aiRiskLevel": "medium",
  "aiRiskSummary": "The website has a moderate security posture with a grade of C, indicating several areas for improvement. Key missing headers and weak configurations could expose the site to potential vulnerabilities, particularly regarding cross-origin policies and cookie security.",
  "aiTopFixes": [
    "Implement missing headers: permissions-policy, cross-origin-opener-policy, and cross-origin-resource-policy.",
    "Strengthen the Content Security Policy by removing 'unsafe-inline' to mitigate XSS risks.",
    "Set the HttpOnly flag for the '_octo' cookie to prevent access via JavaScript."
  ],
  "observedAt": "2026-08-16T19:27:16.206Z",
  "error": null
}
```

### What you get

- A letter **grade** (A+ to F) and a **0 to 100 score** for every site, from a fully documented rubric (below). No black-box number.
- **Per-header analysis** of the headers that matter: Strict-Transport-Security (with parsed max-age, includeSubDomains, preload), Content-Security-Policy (present plus weakness flags such as unsafe-inline, unsafe-eval and wildcard sources), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the Cross-Origin-Opener / Embedder / Resource policies.
- **HTTPS enforcement and the full redirect chain**, so you can see whether http:// is upgraded to https:// and where each hop leads.
- **Cookie security flags** for every Set-Cookie: Secure, HttpOnly and SameSite, with a list of insecure cookies and exactly what each one is missing.
- **Information-leak headers** flagged (Server, X-Powered-By, X-AspNet-Version) so you know what a site is telling attackers about its stack.
- **`missingHeaders` and `weakHeaders`** arrays that read like a ready-made to-do list.
- Optional **TLS certificate** details (issuer, validity window, days until expiry, SAN list, key type and size, hostname match) for certificate-expiry monitoring.
- Optional **AI security posture assessment** with a plain-English summary and the top 3 prioritized fixes.

### Input

| Field | Type | Description |
| --- | --- | --- |
| `urls` | array | One or more websites to scan. Accepts a full URL (`https://example.com/path`) or a bare domain (`example.com`, scanned over HTTPS). |
| `url` | string | Alternative to `urls`: a single site, or several separated by commas, spaces or new lines. |
| `includeTlsCertificate` | boolean | Paid add-on (default off). Return the leaf TLS certificate for each host. Billed only when a certificate is retrieved. |
| `withAiRisk` | boolean | Paid AI add-on (default off). Return an AI security posture assessment and the top 3 fixes. Billed only on usable output. |
| `maxUrls` | integer | Maximum number of URLs to process. Free Apify accounts are capped at 10 URLs per run. |
| `proxyConfiguration` | object | Optional proxy settings. Scanning works without a proxy. |

### Output

| Field | Description |
| --- | --- |
| `url` / `finalUrl` | The requested URL and the final URL after following redirects. |
| `statusCode` | HTTP status code of the final response. |
| `redirectChain` | Ordered list of `{from, to, status}` redirects followed. |
| `httpsEnforced` | Whether the site enforces HTTPS (http upgraded to, or request stayed on, https). |
| `grade` / `score` | Letter grade (A+ to F) and numeric score (0 to 100). |
| `securityHeaders` | Parsed security headers, including structured HSTS and CSP. |
| `infoLeakHeaders` / `server` | Information-leak headers disclosed by the site. |
| `cookies` / `cookieFlagsOk` / `insecureCookies` | Cookie flags, an all-cookies-safe boolean, and the list of unsafe cookies. |
| `missingHeaders` / `weakHeaders` | Recommended headers that are absent, and headers present but misconfigured. |
| `tlsCertificate` | TLS add-on: subject, issuer, validity, days until expiry, SAN, key type/size, hostname match. |
| `aiRiskLevel` / `aiRiskSummary` / `aiTopFixes` | AI add-on: risk level, plain-English assessment and top 3 fixes. |
| `observedAt` | When the scan was performed. |
| `error` | Error message if the site could not be scanned (this row is never billed). |

### Scoring rubric (transparent)

Every site starts at **100 points**. Deductions are applied as follows, then the score maps to a letter grade. This is the exact weighting used in the actor, so you can reproduce and defend any grade.

| Control | Missing | Weak / misconfigured |
| --- | --- | --- |
| Content-Security-Policy | -25 | -10 (unsafe-inline, unsafe-eval, wildcard source, no frame-ancestors) |
| Strict-Transport-Security (HSTS) | -20 | -8 (max-age below 180 days) |
| X-Content-Type-Options | -10 | -5 (not `nosniff`) |
| X-Frame-Options | -10 (unless CSP sets frame-ancestors) | - |
| Referrer-Policy | -8 | -4 (unsafe-url) |
| Permissions-Policy | -7 | - |
| Cross-Origin-Opener-Policy | -3 | - |
| Cross-Origin-Resource-Policy | -2 | - |
| HTTPS (site served over plain http) | -15 | -10 (http not redirected to https) |
| Each information-leak header (Server, X-Powered-By, X-AspNet-Version) | -2 | - |
| Insecure cookies (missing Secure / HttpOnly / SameSite) | up to -8 | - |

Grade bands: **A+** 95 to 100, **A** 85 to 94, **B** 75 to 84, **C** 65 to 74, **D** 50 to 64, **E** 35 to 49, **F** below 35.

### Use cases

- **Security audits and posture monitoring** across a portfolio of domains, on a schedule.
- **PCI DSS, SOC 2 and ISO 27001 prep**: evidence that HSTS, CSP, secure cookies and HTTPS redirects are in place.
- **Penetration-test and bug-bounty recon**: quickly surface missing headers, unsafe cookies and leaky Server banners across a scope.
- **Vendor and third-party due-diligence**: grade a supplier's public sites before you integrate or sign.
- **TLS certificate-expiry monitoring**: catch certificates that are about to lapse, with issuer and SAN detail.
- **Marketing and lead-gen for security vendors**: grade a prospect's site and lead with the top 3 fixes.
- **Continuous compliance dashboards**: feed the grade and `missingHeaders` into your own reporting.

### Billing

This actor uses pay-per-event pricing:

- **Result** ($0.008) - one graded security record per scanned URL: grade, score, per-header analysis, cookie flags, HTTPS enforcement and redirect chain. Unreachable or challenged sites return an unbilled error row; you are never charged on failure.
- **TLS certificate details** ($0.008, opt-in via `includeTlsCertificate`) - charged once per URL, only when a certificate is actually retrieved.
- **AI security posture assessment** ($0.012, opt-in via `withAiRisk`) - charged once per URL, only when the model returns a usable assessment.

Paid add-ons are disabled for free Apify accounts, and free accounts are capped at 10 URLs per run.

# Actor input Schema

## `urls` (type: `array`):

One or more websites to scan. Accepts a full URL (https://example.com/path) or a bare domain (example.com), which is scanned over HTTPS.

## `url` (type: `string`):

Alternative to URLs: a single website, or several separated by commas, spaces or new lines.

## `includeTlsCertificate` (type: `boolean`):

Opt-in paid add-on ($0.008/URL). Opens a TLS connection to the host and returns the leaf certificate: subject, issuer, validity dates, days until expiry, SAN list, key type/size, serial and hostname match. Billed once per URL only when a certificate is retrieved. Disabled for free Apify accounts.

## `withAiRisk` (type: `boolean`):

Opt-in AI add-on ($0.012/URL). Uses AI to turn the grade, missing/weak headers and cookie issues into a plain-English security posture assessment plus the top 3 prioritized fixes (riskLevel, summary, topFixes). Billed only when usable output is produced. Disabled for free Apify accounts.

## `maxUrls` (type: `integer`):

Maximum number of URLs to process. Free Apify accounts are capped at 10 URLs per run.

## `proxyConfiguration` (type: `object`):

Optional proxy settings. Scanning works without a proxy; a proxy can help with geo-specific responses or large batches.

## Actor input object example

```json
{
  "urls": [
    "https://github.com",
    "https://example.com",
    "stripe.com"
  ],
  "includeTlsCertificate": false,
  "withAiRisk": false,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://github.com",
        "https://example.com",
        "stripe.com"
    ],
    "proxyConfiguration": {
        "useApifyProxy": false
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("scrapers_lat/website-security-headers-scanner").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "urls": [
        "https://github.com",
        "https://example.com",
        "stripe.com",
    ],
    "proxyConfiguration": { "useApifyProxy": False },
}

# Run the Actor and wait for it to finish
run = client.actor("scrapers_lat/website-security-headers-scanner").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://github.com",
    "https://example.com",
    "stripe.com"
  ],
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}' |
apify call scrapers_lat/website-security-headers-scanner --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,scrapers_lat/website-security-headers-scanner"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/wF0g3zqFHyWtCdyN1/builds/eEizdbjX3d6ihLhrj/openapi.json